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Introduction: 
ACCESS GRANTED 


Combining toughness and sophistication, the skilled, highly intelligent, 
band-of-outsiders "dream team" has to be one of the most compelling 
cinema creations ever depicted. Even in its endless combinations, a group of 
individuals with specialized - usually criminal - skills manages to be both 
unstoppable and enviable. They're anti-heroes who can go anywhere, and 
among them is always someone who can fool a security guard, someone 
who can hack into networks and spy on traffic, someone who can pick locks 
and open any door, and so on. 


Then there are the people who do these things in real life. Usually for 
a living. 
We at Rift Recon are the people who do the real-life versions of these things 
- more importantly, we outfit and tailor tool kits for the physical security 
pros who do these things, and we train them, too. 


Access Prohibited is our guidebook to the tools you'll find in a physi- 
cal security penetration tester's "black bag" Calso called a "Red Team 
Kit"). This book is also a fully illustrated, step-by-step how-to guide for the 
successful use of black bag tools, plus in the field tricks that haven't been 
shared until now. 


The cinema's dream team is a popular formula, and it's one we all 
know well. But it takes a certain kind of curious mind to venture further 
than just being merely entertained by this storytelling device, the formula 
of the thief, the hacker, the driver, the tool specialist (and so on). Someone 
with this more-curious-than-most mind feels inspired watching the dream 
team in action, and might identify with one or a few of the characters. Not 
content to sit still, the curiously inclined wants to be more than just curi- 
ous; compelled to peel back the layer of artifice, they must find out which of 
these techniques are real, and how the tricks are done. This person actually 
wants to do these things. 


The person I'm describing is you - and myself, too. 


You may have picked up Access Prohibited for a variety of reasons. 
Those who study bypass techniques, or enjoy the wider interests of the 
locksport crowd might want to pick through the text and illustrations, 
seeing which things they already knew and see if we've included anything 
that surprises them. You may have bought this book because you're a pro- 
fessional physical security penetration tester and want to make sure you 
add to your knowledge base at every opportunity. 


It could be that you're looking through these pages because you enjoy 
exploring the controversial edges of hacking in the physical realm. Maybe 
you're inspired by those films and shows that feature smart outsiders who 
employ dubious - though exciting - talents to complete their tasks and mis- 
sions. Or, you just want to see the world of locks and security through a 
different lens, one seen by very few people - perhaps you already do. 


You may be reading Access Prohibited because you want to do every- 
thing in your power to build a safe home or reinforce a secure business - 
you want to make sure that what stands between you and losing what's 
important to you isn't something as simple as a file folder slid between a 
crack in your door. Some of you are going to pour over these pages because 
you're an at-risk individual, and want to make sure you have everything 
possible in your arsenal to ensure you don't wind up as a Statistic, such as 
a woman held against her will. 


Perhaps you're just a spy skills aficionado who's ready to soak up 
some new tricks, or a spy skills fan. But the majority of people picking up 
this book are physical security professionals on all levels and in all indus- 
tries. To know how to subvert security is to know how to strengthen it; this 
is conventional wisdom for security workers and guards at hotels, offices, 
convention centers, storage facilities, manufacturing plants, and much more. 


Access Prohibited is a complete compendium of cracks, hacks and 
physical bypasses used by the world's top urban infiltrators every day. 
Many of these clever entry and exit techniques use ordinary, everyday 
items - though some use specialized tools that require skill and practice, 
some of which have only been shared among elite security professionals 
until now. 


On these pages you'll lean techniques both basic and advanced about 
opening most every type of door you'll encounter in everyday urban and 
office settings, from latch loading calso known as carding a door) and pick- 
ing locks to fooling heat sensors, magnetic switches and doors that only 
open from the inside. 


See examples of in-person entry tools that support social engineering, 
such as specialized badges and helpful office equipment with hidden com- 
partments. Find out how to select a multi-tool and headlamp to get for 
covert urban missions, learn about using LAN Taps for electronic 


surveillance, and which endoscope is best when you want to keep a low 
profile. Read the descriptions and Modus Operandi for each tool and you'll 
also learn step-by-step how to clone keys, how to defeat padlocks and circu- 
lar locks, and more. 


Every page features a tool or toolset, with full description and tips for 
the best ones to get, a photo, simple steps to use the tools in the field, and a 
multi-panel illustration that clearly shows effective use techniques. The 
entire collection comprises a full infiltration toolkit, while some sections 
provide examples of basic tools, the reasons you'll need them, and what to 
look for when you need to select the right one for the job. 


The collection of tools and techniques in Access Prohibited are, in fact, 
the composition of Rift Recon's "Red Team Kit" - a black bag kit used by 
professional physical security penetration testers worldwide. Everything 
here is real, and it works. 


The knowledge in this book combines that of a locksmith apprentice, a 
network and physical security penetration tester, a physical security private 
contractor, and of those involved with law enforcement covert entry teams. 
The pages of this book are the Red Team Kit's dossier, for field use and 
reference, and we've adapted them here to provide a guide for everyone 
interested in what goes into - and happens with - those little black bags. 


Most of the techniques described here require familiarity with the 
tools and how they behave, and plenty of practice. It's a fairly advanced 
guide that has been boiled down to the basics with a kick; this guide leaves 
nothing to chance even in its simplest terms, and it's a resource you'll 
return to for deeper techniques once you've mastered the basics. 


Most of what you'll find in Access Prohibited has been hidden or kept 
secret until now. We strongly feel that this suppression of knowledge about 
real-life vulnerabilities isn't making anyone safer (though it is making the 
people guarding those secrets richer). We hope that providing the open 
access to this information empowers you, teaches you some fun and 
eye-opening tricks and skills, and helps to make your world a better place. 


Eric Michaud and the Rift Recon team 
San Francisco, California 
RiftRecon.com 


UNDER THE DOOR TOOL 


This industry standard tool bypasses some pretty 
expensive security hardware with a clever mech- 
anism. Rift Recon’s Under The Door Tool is com- 
prised of two primary parts: a bent rod (that can 
be bent further to fit inside the bag) and a wire 
to control the other side of the rod. 


Slide the L-shaped end of the tool 
under the door. 


STEP 2: 

Twist the tool upright and lean it 
toward the door handle, and then 
work the tool over the handle. 


STEP 3: 

Once you feel it on the handle, 
pull down on the cable to open 
the door. 


LOCKPICKS 


Lockpicks are often an essential part of every 
mission and are a classic tool in the physical 
penetration testers toolkit. You may not use them 
every time but when you need them you'll be 
glad they're in your kit. 


A standard set of lockpicks will have a short 
hook, a snake rake, a half diamond, a variety of 


other picks, and of course, tensioning tools. 


Lockpicks made from spring steel or titanium are 


ideal because they’re less prone to cracking and 
provide good feedback in the hand. 


IMPLEMENTATION 
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PLUG SPINNER 


When you find that a lock is easier to pick to the 
locked position instead of the unlocked position, a 
plug spinner generates enough force to disallow 
pin tumblers from resetting the lock. Our Red 
Team Kit’s selection in a plug spinner tool isn’t 
like the others; ours is exceptionally portable, 
small, compact and its strength matches its older, 
clunkier cousins. 
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CLIPBOARD 
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IMPLEMENTATION 
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BADGE COVERS & LANYARDS 


When your mission calls for assessment that re- 
quires in-person ID, having the exact employee 
badge becomes a make-or-break situation. 


Employee badges come in a wide range of shapes 
and sizes, so it’s crucial to have a variety of 
badge and lanyard options at hand. 


(Covers for both horizontal and vertical badge 
orientations come stock in Rift’s Red Team Kit.) 


KNIFE TOOLS 


Included in our Red Team Kit are two knife tools: 
knife tools are ideal for many uses, notably for 
reaching through lock keyways to act on elements 
beyond the pins. Knife tools are excellent for 
opening commonly used padlocks and filing 
cabinets. 


The Master Lock #175 wheeled combination 
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ENDOSCOPE 


An endoscope is critical in the recon phase of any 
assessment - it goes where your eyes can’t, and 
its lighting capability is indispensable in dark en- 
vironments. 


Endoscopes come in a range of sizes and price 
points, from the small filament with a hefty price 
tag, to mid-sized and beyond. Be sure to choose 
an endoscope that works in variable conditions 
and won’t sink your pocketbook if you have to 
leave it behind. Rift’s mid-size waterproof endo- 
scope beat the competition in every test we put it 
through, and can be utilized with laptops, phones 
and tablets Cusing generic drivers). 


IMPLEMENTATION 
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HEADLAMP 


Operating under darkness is often a necessity, 
making the selection of your headlamp important. 
Your headlamp needs to fit properly, operate reli- 
ably, and function in a way to ensure you don't 
blind yourself with white light in the field. 


In order to find the right unit, Rift tested a sur- 
prising number of headlamps. Our headlamp fi- 
nalist features a very bright white maxbright 
LED in addition to three smaller LEDs for red 
lighting, which prevents your dark (or nighttime) 
visual adaptation from being spoiled - you must 
hold the button to activate white light so you 
won't accidentally bump the button on and ruin 
your night vision. 


IMPLEMENTATION 
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HAND WARMER 


Hand warmers can be used for more than their 
originally intended purpose. When you need to 
trigger an exit sensor reliant on thermal differen- 
tials as well as motion, a well-chosen set of 
warmers will get you on your way. 


Open package to activate warmer. 


STEP 2: 

Attach warmer to either a wire 
and slide it through the gap, or 
just slide it under the door to 
activate thermal and motion 
sensors. 


IMPLEMENTATION 
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ELEVATOR FIRE KEYS 


A set of elevator fire keys will ensure that you 
have full control over most elevators you encoun- 


ter in the field, can go to whichever floor you 


want, and can also hold elevators at those floors. 


IMPLEMENTATION 
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To reach the taraet Floor, get in the el- 
evator and turn the fire service ke 
switch to the ON setting. Select Floor and 
hold the Close Door bufton until the door 
Fully closes. 


To exit, press the Open Door button until 
door fuk opens. Remember that iF you 
release the door Key at any time, the el- 
evator door will go back to its previous 
state open/closed 


Don'+ Forget to reset each of the ke 
switchs or the elevators may lock out le- 
gitmate users who need it. 


COPPER WIRE 


After much testing, we selected a conductive wire 
our Red Team customers that has a precise thick- 
ness and tensile strength. Too thick, and the wire 
would be too bulky, heavy and hard to bend and 
fit into narrow spaces. Too thin, and the wire 
wouldn’t retain its shape. 
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PUSH TO EXIT BAR TOOL 


When you come up against a door, and the 
push-to-exit bar is on the other side, you dont 
need to figure out plan B when you have the 
right tool at hand. 


Theres no need to improvise a way to pull back 
on push-to-exit bars from the outside: tried, 
tested and true, this tool is perfect. 


Our Push To Exit Bar Tool has it all: a firm 
handle, a rubber tip for grip (and to prevent 
leaving marks), plus strong steel fabrication set 
to last many uses and several years. 
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MAGNETS 


Many sensors rely on (or are disturbed by) mag- 
netic fields - so they’re easily manipulated with 
small magnets. 


For these examples we'll describe the magnets in 
our Red Team Kit. The first is a round disc 
magnet half a millimeter thick with a surprising 
pull force of more than 6 pounds. The second 
magnet is also a disc, but much thicker. 


Covered in teflon, it can be used underwater, in a) Bypas S 


salt water or even in weak acids. Teflon makes it BSS al 
non-marring, so its easy to remove and you dont 
have to worry about using it on easily-scratched 
surfaces. 
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LATCH LOIDING 


Loiding is also known as carding a door. Our Red 
Team Kit features a variety of tools that can be 
used for loiding: house numbers, a shove knife, a 
shrum tool, and our handpicked file folder. 


The house numbers are discreet, unsuspicious and 
provide plenty of leverage. The shove knife is a 
pro tool featuring different tips. The shrum tool 
is very strong. When you need an odd shape, our 
file folder can be trimmed to spec. 


Insert tool into the door jam above 
or below the latch. 


STEP 2: 
Slide tool over the latch. 


STEP 3: 
Apply pressure to the latch and pull 
the tool back, opening the latch. 


From the opposite side: 
Push the tool straight into the latch, 
popping it open. 


IMPLEMENTATION 
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TAPE 


Three specific tape products are chosen for our 
Red Team Kit; each is selected for uses specific 
to physical penetration assessment activities, 
strength, and lack of evidence. 


The mini-roll of gaffer’s tape - the beefier cousin 
of duct tape - is stronger than duct tape, easier 
to rip by hand, and doesn’t leave behind a sticky 
residue. The double-sided masking tape is strong, 
the thinnest in its class, and won't leave any 
remnants. 
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Finally, we always include double-sided foam tape 
squares, which also leave little trace. 


IMPLEMENTATION 
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BUMP KEYS 


A bump key is a modified key blank with the 
lowest key bitting allowed by code. When inserted 
into the right lock and struck with a bump 
hammer, the bump key will cause the driver pins 
to leap above the shear line, thus making the 
lock ready to open. 


When timed with a quick turn, the lock opens. 
Locksmiths have known this technique for de- 
cades but it wasnt shared publicly until recently. 
A bump hammer is a tool that applies force to 
the key. Alternatively, any light weighted object 
can be used, like the handle of a screwdriver. 


STEP 1: 
Slide bump Key into lock, pull it out one 
pin-length. 


STEP 2: 
Put slight pressure in the direction it 
should turn. 


STEP 3S: 
Give the key a light tap with the bump 
hammer. Lock opens. 


STEP 4: 
If the lock doesn’t open, pull key back 
one pin-length, repeat steps 1 and 2. 


LUBRICANT 


The wrong lubricant can tank your entire mis- 


sion. That’s why we recommend a lubricant that 
is a PTFE in a solvent base for phyiscal security 
assessments. 


WD-40 is a great lubricant in many cases, but 
terrible for locks - it dries and parts re-freeze. 
Graphite is messy and can clog lock cylinders 
when moisture enters. Wet lubricants can be ideal 
but most will attract dirt and dust into clean en- 
vironments. 


We make sure to outfit our Red Team customers 
with a PTFE based lube, which can do what other 
lubes can without their drawbacks. 


When you're out ona wie 

st a Few spray ee 
one free up stubborn locks 

asy, quiet mani 

ae Yd dirty loc 
i be used with mann 

a sien Sega (Lor sliding in and ae 

iar gee lied on stuck screws, 


ca Seren ae Xbcorn Lile cabinet slid- 
inges, : 


ers, and much more. 


\ 


AMMA AAA 4 44 Pree 


HANDOCUFF SHIM 


Small, concealable, covert: a good handcuff shim 
is made of strong spring steel, and primed for 
use many times over. Reliably strong, it’s also 
thin enough to use on police-issue handcuffs that 
are made with tighter tolerances. 


IMPLEMENTATION 
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Maintain pressure on the shim and over- 
tighten the handcuFF£ to pull the shim down 
into the housing further. 


It almost feels like you're using the shim to 
press the teeth deeper and tighten the 


cuF. (it can help to use a table or edge of 
a chair.) 


Once the shim inserts Fully into the housing, 
rotate your wrist out of the cuf& 


After one wrist is Free, repeat the pro- 


cess on the other wrist with both hands in 
Front. 


MULTI-TOOL 


Muti-tools are essential, and allow you to perform 
a multitude of actions with a minimal carry. 


Full-size multi-tools are all typically about 100mm 
long when folded, and ones with a serrated knife 
will make the knives on other multi-tools seem 
like a nail file in comparison. A multi-tool with a 
longer and thinner Phillips head screwdriver than 
other multi-tools are suited for computers and 
server racks. And believe it or not, read the 
manual that comes with your multi-tool; few 


people do, and many miss out on less obvious fea- 
tures within the tool. 


The pentester’s multi-tool must meet a number 
of very specific requirements. Namely, a Red 
Teamer’s multi-tool should be specifically 
tested and selected for high stress and high 
performance in-the-field actions. 


IMPLEMENTATION 
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WATERPROOF NOTEBOOK, 
PEN, & PENCIL 


Despite electronic recon tools, a standard notepad 
is a required piece for a stealthy and efficient 
mission. A standard-issue item in Rift Recon’s 
Red Team Kit, the Field Notes notepad is made of 
resilient, high quality Yupo Synthetic Paper - the 
same as the print edition of this dossier. This 
material is uniquely waterproof and extremely 
tear-resistant. 


With a pen you can take notes on the notepad 
underneath a full-flowing stream of water. Go 
ahead - try it. Our selection of grid-layout paper 
makes sketching out floorplans, recon notes, and 
mission schematics a snap. 


IMPLEMENTATION 
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Use the LAN Tap to sniff traffic over the wire. 
With this tap, there’s no need for wire splicing 
and cutting, or messing with bulky powered 
switches. Plug an ethernet cable into one side and 
make the other connection to the device and use 
the other two ports to passively sniff all traffic. 
Our LAN Tap has the requisite capacitors to nego- 
tiate a gigabit connection down to a 100 megabit 
so that it can still be passively tapped without 
any external power. On the monitoring ports, the 
transmit lines are disabled so that it is impos- 
sible to transmit information out - perfect for 
staying hidden. 


STEP 1: 
Remove ethernet cable from host, 


BP and plug it into the A port. 
"a STEP 2: 
Plug a second cable into the 
B port, then plug the other end 
aw into the host you removed the 


first cable from. 


Use monitoring ports to capture 
traffic. 


IMPLEMENTATION 


So small you can carry this in your 
pocket - and make sure you bring 
three ethernet cables. Plug your 
target's ethernet cable into port "A. 
Then plug one of your ethernet cables 
into port "B'. Take the Free cable end 
and plug it into the target port. 


q 


Now you're able to use the monitorin 
ports to capture the traffic that you 
need with a device running TCPdump, 
Wireshark, or a similar program. Note 
that each port captures traffic 
Flowing in a single direction. 


CLAMSHELL KIT 


The central player in the key cloning Clamshell 


Kit is the clamshell itself: the kit is portable and 


includes overflow channels. The low-temp melt 
alloy in the kit is non-toxic and melts below 


200F; it’s a eutectic alloy, which makes it much 
easier to pour and form a key. We prefer an ad- 
justable butane lighter, which burns hotter than 


non-butane, and its kickstand lets you work 
hands-free. Also included: a sharp scraper 
and Plasticine. 


IMPLEMENTATION 
Step I: Prep 


Sauish the Plasticine into each half of 
the clamshell mold. 


Sandwich the ke you want to clone 
between the two halves of the clam- 
shell: 


Only part of the key handle should be 
sticking out. Press the clamshell togeth- 
er, and then gently separate the ave 
and remove the key. 


Step Ds Cloning 


Use a thin tool (like a lockpick) to 
scribe thin, shallow lines From the key 
impression toward the Front of the 
clamshell, exiting out one of the side 
channels. Dust tale lightly over the Plas- 
ticine to prevent sticking, 


Compress the halves again and use the 
rubber bands to hold the clamshell shut. 
Next, put some of the low-melt metal 
into the ladle. Use the lighter to melt the 
metal until Fully liquid. Pour the liquid 


metal into the closed clamshell. ay peri- 
ae tapping the shell on a hard sur- 
Face to avoid air bubbles. 


Step 3 Use 


Wait 5-b minutes Lor the metal to 
cool and solidify. 


Separate the clamshell to remove the 
cloned Key. 


rfLections, snap off 


Check for impe' have a key that's 


rrotrusions and you 
good for 5-10 uses. 


DENTAL FLOSS 


Dental floss is ideal for a surprising multitude of 
uses. It’s strong (especially when doubled-up or 
braided), and waxed floss will squeeze and slip 


through tight spaces in a way that few other ma- 
terials can. 


IMPLEMENTATION 


Soe 


can be used a 
ede tie floss to a magnet 


string For light uses 
to create a pickup tool. 


r defeating 
Joaded latches; 
top to thread 


This technique is great Fo 
locker cabinets with spring 
i i locker's 
insert Flos¢ into the 
it through the bottom oF the cabinet. 


Then pull the Lloss From both ends over iz 
the side where the latch is - While you pub 
the Floss retracts the latch to pop open 


the door. 


__— 


STEP 1: 
Thread floss in the top and 


through the bottom of the 
door. 


STEP 2: 
Pull through the side with 
the spring-loaded latch. 


STEP 3: 

The floss will retract the 
latch and the door will 
open. 


FILE FOLDER 


Although it’s an ordinary, everyday item, the file 
folder is a bypass tool in disguise - which is why 
you'll find a file folder in every expert physical 
security penetration tester’s toolkit. Yet while some 
use the old, familiar beige folders we're all familiar 
with, any old paper file folder simply isn’t tough 
enough to go the distance. 


About the same thickness as a standard manila file 
folder, a polypropylene file folder can handle all 
sorts of abuse - and will definitely take you where 
no paper folder has gone before. This attack works 
best on double-door entrances/exits with a motion 
detector placed right in the middle. 


Open ‘the folder so it’s one long 
piece of plastic. 


Step 2: 

Slide most of the folder through 
the gap between the two doors 
while leaving a bit for your 
hand to hold the folder. If it 
feels too tight, use some spray 
ube. 


fal\\) 


Step 3: 

Wave the folder near the 

motion detector. This should 

a the sensor and unlock the 
oor. 


Implementation 


the file Folders primary implementation 


l \e 
is Lor insertion through echkeiae 
the top of a door to trigger mo io 


onl 
sensors. (Motion sensors are commonly 


used to detect people trying to ie 
their articulation is to senda are 
the system to unlock the doors. 

the Folder with your 


iaht doors, prime 
: d Team de dry lubricant. Our tough 
ne d in place ofa 


be use 
folder can also 
shim, to maneuver pesky latches out 


of the way. 


— es 


TUBULAR LOCK PICK 


Circular locks - the kind you’ll see on file cabi- 
nets, lockers and bike locks - are called tubular 
locks, and this breed of security hardware has 
evolved its own specialized opening tool. A tubu- 
lar lockpick makes most of these locks surpris- 
ingly easy to open; our choice is one that con- 
verts for use with both 7-pin and 8-pin tubular 
locks, and comes with extra parts so youre cov- 
ered if parts break in the field 


IMPLEMENTATION 


bos a key, or use its 
easure a lock's 
ade at a later time. 


STEP 1: 


Remove cap and press the tool’s tip down 
on a flat surface. 


use a tubular lockpic 
tubular Key 9ou9¢ sere 


key m 

depths and get a Key ma ace 

at isn't a tool +o use without eee es 

need to Feel the appropriate amou seers 
ion set by the threaded collar. Conve’ 

S 


i d 
an &-pin tubular lock: remove its threade 


i + 
collar aind compression ring loosen the sé 


w (hold its shaft inside the handle), y 
er the Feeler covering the rolled in a 
come a nail to push the pin = insert S ; é 
a way 3° the tool aligns with an &-pin tu 
ular lock. When you put it aan aie 
only hand-tignten the set screw TO 


over-tightening, 


STEP 2: 
Use the washer to press all of the feelers 
down flush against the tip. Index the rolled 


index pin with the notch in the tubular 
lock. 


STEP 3: 
Put the tool into the lock, rotate it back and 
forth lightly, repeat until the lock opens. 


STEP 4: 
When the lock opens, tighten the threaded 


collar down so you dont lose the bitting of 
the lock. 
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ABOUT RIFT RECON 


RIFT RECON criftrecon.com) tailors its clients from a suite of exclusive 
physical security services to meet specialized needs in hardware, assess- 
ment reports, tool creation and team outfitting, specialized trainings, and 
expert referrals. Rift operates across varied security industries, including 
product security, physical security, hardware research and development 
CGncluding gadgets and kits), and caters to professionals striving to meet 
their own clients’ various physical security needs. 


Rift works with a range of clients from independent trainers to high net 
worth individuals, as well as red teams, indie physical security contractors, 
product security teams and companies requiring exacting hardware assess- 
ment reports. Discreet and methodical, Rift stands as the company in the 
world positioned to expertly source, secure, or innovate and manufacture 
hardware to meet the exacting, often critical, hardware security needs of its 
clients. 


ABOUT RIFT RECON CEO ERIC MICHAUD 


ERIC MICHAUD (@EricMichaud) is Founder and CEO of Rift Recon and 
Director of Hardware Curation at ExploitHub. He has advised on physical 
security, lockpicking, and hackerspaces for over a decade. Michaud is a 
professional physical security advisor; an R&D, test and analysis expert; 
and specializes in forecast and strategy. He started HacDC and Pumping 
Station: One, is the author of the How To Start A Hackerspace Series, and 
advises hackerspaces - bringing the movement to over 900 locations world- 
wide. 


Michaud’s skill opening impossible-to-pick locks earned him a place in lock- 
sport history with the "Michaud Attack." He co-founded and served on the 
Board of Directors for TOOOL US and is referenced widely in academic 
papers, talks and books including Open In Thirty Seconds. 


